DNSSEC checker

This is a presence check. It never verifies RRSIG signatures, so nothing here proves the cryptography holds; the DS digest recomputation lives in the sibling DNSSEC validator. The AD flag is the resolver's claim, not a proof, and an empty RRSIG answer is weak evidence because resolvers only hand out signatures when the query asks for DNSSEC data. An unsigned domain is a normal state, not a fault.